CVE-2024-23314
📋 TL;DR
This vulnerability affects F5 BIG-IP and BIG-IP Next SPK systems with HTTP/2 configured. Undisclosed HTTP/2 responses can cause the Traffic Management Microkernel (TMM) to terminate, leading to denial of service. Only systems running supported software versions are affected.
💻 Affected Systems
- F5 BIG-IP
- F5 BIG-IP Next SPK
📦 What is this software?
Big Ip Application Acceleration Manager by F5
View all CVEs affecting Big Ip Application Acceleration Manager →
Big Ip Application Acceleration Manager by F5
View all CVEs affecting Big Ip Application Acceleration Manager →
Big Ip Application Acceleration Manager by F5
View all CVEs affecting Big Ip Application Acceleration Manager →
Big Ip Application Security Manager by F5
View all CVEs affecting Big Ip Application Security Manager →
Big Ip Application Security Manager by F5
View all CVEs affecting Big Ip Application Security Manager →
Big Ip Application Security Manager by F5
View all CVEs affecting Big Ip Application Security Manager →
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption as TMM termination causes all traffic management functions to fail, requiring manual intervention to restore service.
Likely Case
Intermittent service outages and degraded performance as TMM restarts automatically but causes connection drops during termination.
If Mitigated
Minimal impact with proper monitoring and automated recovery mechanisms in place to handle TMM restarts.
🎯 Exploit Status
Exploitation requires sending specific HTTP/2 responses to vulnerable systems, which can be done remotely without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check F5 advisory K000137675 for specific fixed versions
Vendor Advisory: https://my.f5.com/manage/s/article/K000137675
Restart Required: Yes
Instructions:
1. Review F5 advisory K000137675
2. Identify affected systems and versions
3. Download and apply appropriate patches from F5 downloads
4. Restart TMM services
5. Verify patch application and functionality
🔧 Temporary Workarounds
Disable HTTP/2
allTemporarily disable HTTP/2 configuration to mitigate vulnerability until patching
tmsh modify ltm profile http2 <profile_name> disabled
Implement Rate Limiting
allConfigure rate limiting on HTTP/2 traffic to reduce attack surface
tmsh create ltm policy http2-rate-limit
🧯 If You Can't Patch
- Disable HTTP/2 configuration on all vulnerable systems
- Implement network segmentation to restrict HTTP/2 traffic to trusted sources only
🔍 How to Verify
Check if Vulnerable:
Check if HTTP/2 is configured: tmsh list ltm profile http2 | grep -i enabledCheck Version:
tmsh show sys versionVerify Fix Applied:
Verify patch version matches fixed versions in F5 advisory and HTTP/2 functionality remains operational📡 Detection & Monitoring
Log Indicators:
- TMM termination events in /var/log/ltm
- Unexpected TMM restarts
- HTTP/2 connection resets
Network Indicators:
- Increased HTTP/2 error rates
- Unusual patterns in HTTP/2 traffic
SIEM Query:
source="/var/log/ltm" AND "TMM terminated" OR "HTTP/2 reset"